A distributed computing system typically allows for the sharing among locations or facilities information processing functions by a collection of computers and other devices linked together by a communications facility such as a network. Quite often, such distributed computing requires a highly structured environment which allows hardware and software to communicate, share resources, and freely exchange information.
Many large computing systems include resources such as one or more central processing units, main memories, disk and/or tape storage units, and printers. Such a system may also include user terminals or client terminals, such as workstations. In many implementations, each user or client terminal may have its own local resources, such as one or more central processing units, associated main memory, a printer, and a disk or tape storage; or a client or user terminal may request such resources from one or more servers or other workstations.
In the present application, it is understood that workstation includes other user terminals that are not necessarily sold as workstations, such as personal computers.
Different approaches have been used to maintain the security of system resources from unauthorized access. One such approach is the use of security tokens or authentication tickets carried from the client to a server. Such a security token or authentication ticket is used to reliably prove the identity of the client to the server and further establish a way of securing subsequent communications between the two entities, hence establishing a secure association between the client and the server.
Due to the cost of computing the security token, a computation that takes place over the distributed computing network because of the need to intervene and secure a security token from a security server, as well as its size and its relative complexity of computation, a security token is only communicated to the server on the first request. Subsequent to that, the client and the server need to find a reliable way to securely communicate with each other under the security association established by the initial security token sent upon the first request, yet without having to send the initial security token on each subsequent request by the client to the server.
What is needed is a reliable and secure way of identifying a security association between a client and server in a distributed computing system without having to send the initial security token on each subsequent request.